better-supabase 0.15.0 → 0.16.0

package/dist/cli/{content-mapper-DNs7lTu7.js → content-mapper-DCrz6OIv.js}

@@ -1,6 +1,6 @@
 import { r as readIfExists } from "./io-DH1kcmmP.js";
-import { t as CACHE_DIR } from "./cache-CXgR_Ahi.js";
-import { x as installedVersion } from "./snapshot-C8MVPyO8.js";
+import { t as CACHE_DIR } from "./cache-AznIssjI.js";
+import { x as installedVersion } from "./snapshot-uTUlEzY2.js";
 import { t as i } from "./jsonc-D5Fu67jw.js";
 import { resolve } from "node:path";
 import { createHash } from "node:crypto";

package/dist/cli/{doctor-DDrEM6S1.js → doctor-DkOSLPEQ.js}

@@ -1,40 +1,41 @@
 import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
 import { i as plain } from "./style-Bm2X5JrN.js";
-import { t as VERSION } from "./version-Du4CgONY.js";
+import { t as VERSION } from "./version-B2Dr6VmJ.js";
 import { n as CliError, r as errorText } from "./errors-BTe6A15O.js";
 import { i as isLocalDatabaseUrl, r as databaseHost } from "./agent-CbuPvI2x.js";
 import { a as sameText, t as display } from "./io-DH1kcmmP.js";
-import { t as CACHE_DIR } from "./cache-CXgR_Ahi.js";
+import { t as CACHE_DIR } from "./cache-AznIssjI.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
-import { C as satisfies, S as peerVersions, c as isSqliteLiteDriver, n as managementTarget, o as snapshotFile, r as openSource, s as liteDriverOf, t as loadSnapshot, u as MetadataRejectedError } from "./snapshot-C8MVPyO8.js";
-import { d as configFor, r as renderFiles, u as notNullTag } from "./render-ucJmUyuM.js";
+import { C as satisfies, S as peerVersions, c as isSqliteLiteDriver, n as managementTarget, o as snapshotFile, r as openSource, s as liteDriverOf, t as loadSnapshot, u as MetadataRejectedError } from "./snapshot-uTUlEzY2.js";
+import { d as configFor, r as renderFiles, u as notNullTag } from "./render-5y5a1QZr.js";
 import { t as isRecord } from "./guards-CUlDNYZs.js";
-import { i as request } from "./source-DANaJJVc.js";
-import { A as providerLabel, S as moduleLayoutFor, b as blockDeclaredTables, i as migrationHolds, o as migrationModules, r as latestMigration, t as MODULES_SUFFIX, x as migrationsDir, y as compiledReadSets } from "./module-migration-aPCckev6.js";
+import { i as request } from "./source-D2gJHKwC.js";
+import { T as providerLabel, i as migrationHolds, o as migrationModules, r as latestMigration, t as MODULES_SUFFIX, y as compiledReadSets } from "./module-migration-O_IxewFs.js";
 import { l as stdinDatabaseUrl, n as databaseUrl } from "./config-9t5ec_N7.js";
 import { a as findRepoRoot, c as httpHooks, d as readSupabaseToml, f as schemaPaths, h as tomlGet, i as diffEngine, l as migrationCommand, n as declarativeSchemasDir, p as sqlWorkflow, u as pgFunctionHooks } from "./supabase-toml-CncmQbO0.js";
 import { t as PROCESS_ENV } from "./env-DMgjB_4y.js";
 import { n as readStackStatus } from "./stack-status-B_Ipd_-z.js";
 import { t as connect } from "./db-CQCLx7cx.js";
-import { a as hasContentMapper, c as supportsContentMappers, i as contentMapperSetup$1, n as TSCONFIG_SNIPPET, o as needsRunExternalCode, t as RUN_EXTERNAL_CODE } from "./content-mapper-DNs7lTu7.js";
+import { a as hasContentMapper, c as supportsContentMappers, i as contentMapperSetup$1, n as TSCONFIG_SNIPPET, o as needsRunExternalCode, t as RUN_EXTERNAL_CODE } from "./content-mapper-DCrz6OIv.js";
 import { c as insideRoot, i as changeLines, r as applyPlan } from "./files-CX71yBm8.js";
-import { S as splinterTables, _ as withoutStrings, a as METADATA_GAPS_TEXT, b as appTablesOf, c as accessModule, d as RLS_RULES, f as appliesTo, g as policyHelpers, h as functionObject, l as entitlementsModule, m as functionBody, p as escape$2, s as AUTHORIZATION_RULES, u as COMMANDS$2, v as BLOCK_PREFIX, x as advisorRule, y as blockTargets } from "./run-CvYVAztY.js";
-import { a as permissionCatalogKeys, i as lineOf, l as tableObject, n as exposed, o as policyObject, r as exposedSchemas, s as qualified, t as catalogOf, u as workflowOf } from "./shared-LZroULBe.js";
-import { o as wiringFor, r as configInstances, t as MIGRATION_SAFETY_RULES } from "./migration-safety-D7PhzFxm.js";
+import { C as splinterTables, S as advisorRule, _ as withoutStrings, a as METADATA_GAPS_TEXT, b as appTablesOf, c as accessModule, d as RLS_RULES, f as appliesTo, g as policyHelpers, h as functionObject, l as entitlementsModule, m as functionBody, p as escape$2, s as AUTHORIZATION_RULES, u as COMMANDS$2, v as BLOCK_PREFIX, x as appViewsOf, y as blockTargets } from "./run-Bs4OKdDI.js";
+import { n as migrationsDir, r as moduleLayoutFor, t as blockDeclaredTables } from "./sql-layout-lUWenjJw.js";
+import { a as permissionCatalogKeys, i as lineOf, l as tableObject, n as exposed, o as policyObject, r as exposedSchemas, s as qualified, t as catalogOf, u as workflowOf } from "./shared-BLqbvY2x.js";
+import { o as wiringFor, r as configInstances, t as MIGRATION_SAFETY_RULES } from "./migration-safety-BnnXPAro.js";
 import { t as orphanedBlockFiles } from "./orphans-BAboqyVM.js";
-import { i as reservedRoles, n as ident$1, r as literal$1, t as LIVE_RULES } from "./live-iEeH15ck.js";
+import { i as reservedRoles, n as ident$1, r as literal$1, t as LIVE_RULES } from "./live-DGdLR41j.js";
 import { a as sourceFlags, n as SOURCE_ARGS } from "./source-args-IpJRJO5t.js";
 import { i as PLUGIN_SUBPATH_RENAMES, n as BLOCK_SUBPATH_RENAMES, o as SPEC_SUBPATH_RENAMES, t as BLOCK_EXPORT_RENAMES } from "./codemod-block-renames-BuSaTE_G.js";
 import { n as PLATFORM_SCHEMAS } from "./in-stack-diff-DQTW53Vf.js";
 import { i as staleVariables, r as stackEnvValues, t as PREFIX_NAMES } from "./stack-env-6hS-WEmh.js";
 import { a as readSharedMemory, n as listStacks, t as branchName } from "./stacks-BYlQ96WS.js";
-import { i as refuseWithMetadata, r as readMetadataSnapshot } from "./metadata-DVx9Zgbj.js";
+import { i as refuseWithMetadata, r as readMetadataSnapshot } from "./metadata-BfgHMe4q.js";
 import { existsSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { glob, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { DEFAULT_ACTIVE_TENANT, tenantClaimPaths } from "better-supabase/config";
-import { SECRET_COLUMNS, SQL_MODULES, TENANT_SCOPE_POLICY, adoptedTables, blockFileState, blockSqlVersion, contractSignature, customContracts, dataExportPlan, excludedColumns, expiredFlagsQuery, hasColumnAccess, migrationOptionUses, moduleDeprecations, moduleEventTriggers, moduleFileVersion, moduleLayout, notNullCheckName, renderBlocks, sameBlockFile, sameTenantColumn, sameTenantTrigger, scopePolicyName, sharedRolesProblems, subjectColumns, widenedCommands } from "better-supabase/sql";
+import { SECRET_COLUMNS, SQL_MODULES, TENANT_SCOPE_POLICY, adoptedTables, adoptedViews, blockFileState, blockSqlVersion, contractSignature, customContracts, dataExportPlan, excludedColumns, expiredFlagsQuery, hasColumnAccess, migrationOptionUses, moduleDeprecations, moduleEventTriggers, moduleFileVersion, moduleLayout, notNullCheckName, renderBlocks, sameBlockFile, sameTenantColumn, sameTenantTrigger, scopePolicyName, sharedRolesProblems, subjectColumns, widenedCommands } from "better-supabase/sql";
 import { defineBucket, parseSize } from "better-supabase/storage";
 //#region src/cli/doctor/env.ts
 const PUBLIC_PREFIXES = [
@@ -258,6 +259,20 @@ const ADOPTION_RULES = [
 			}];
 		}
 	},
+	{
+		code: "BS349",
+		severity: "warning",
+		title: "Block writes through a view Postgres can't update",
+		description: "A block table is mapped to a view of the app's (`blocks.<name>.tables`), and the block's TypeScript API inserts, updates or deletes its rows, but the view is not auto-updatable and has no `instead of` trigger: it has `distinct`, `group by`, a join, an aggregate or a set operation, or it is a materialized view. The block's functions that read the view work; the API calls that write it fail. Write those rows to the table under the view, add `instead of` triggers to the view, or map the block's table to a table.",
+		check: (context) => {
+			const views = appViewsOf(context);
+			if (Object.keys(views.ownViews).length === 0) return [];
+			return adoptedViews(context.config.blocks, appTablesOf(context), views).filter((view) => view.writes && !view.updatable).map((view) => ({
+				message: `blocks.${view.module}.tables.${view.logical} is the view ${view.view}, which Postgres can't write through, and the block's TypeScript API writes ${view.logical} rows. Those calls fail; write the rows to the table under the view, add instead of triggers, or map ${view.logical} to a table.`,
+				target: view.view
+			}));
+		}
+	},
 	{
 		code: "BS341",
 		severity: "warning",
@@ -1612,7 +1627,7 @@ async function danglingAuditRegistrations(context) {
 async function missingAdoptedColumns(context) {
 	const db = context.database;
 	if (!db || "skipped" in db) return [];
-	const tables = adoptedTables(context.config.blocks, appTablesOf(context));
+	const tables = adoptedTables(context.config.blocks, appTablesOf(context), appViewsOf(context));
 	if (tables.length === 0) return [];
 	const names = tables.map((table) => `(${literal$1(table.schema)}, ${literal$1(table.table)})`).join(", ");
 	let rows;

package/dist/cli/{gen-MtijJQ9r.js → gen-CFkYUnWq.js}

@@ -1,21 +1,21 @@
 import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
 import { i as plain } from "./style-Bm2X5JrN.js";
 import { a as parseNames, i as failedResult, n as CliError } from "./errors-BTe6A15O.js";
-import { u as catalogFingerprint } from "./cache-CXgR_Ahi.js";
-import { a as serializeSnapshot, g as serializeGenerator, h as restrictSchemas, o as snapshotFile, r as openSource, t as loadSnapshot } from "./snapshot-C8MVPyO8.js";
-import { f as dataMigration } from "./module-migration-aPCckev6.js";
+import { u as catalogFingerprint } from "./cache-AznIssjI.js";
+import { a as serializeSnapshot, g as serializeGenerator, h as restrictSchemas, o as snapshotFile, r as openSource, t as loadSnapshot } from "./snapshot-uTUlEzY2.js";
+import { f as dataMigration } from "./module-migration-O_IxewFs.js";
 import { d as GEN_TASKS, p as isGenTask } from "./config-9t5ec_N7.js";
 import { c as insideRoot, r as applyPlan, u as planResult } from "./files-CX71yBm8.js";
-import { n as runGen } from "./run-CvYVAztY.js";
-import { t as syncModules } from "./sync-btj01bcM.js";
-import { t as addModules } from "./add-DCI5JKjA.js";
-import { n as listModules, t as printModule } from "./print-BeWO7OJY.js";
+import { n as runGen } from "./run-Bs4OKdDI.js";
+import { t as syncModules } from "./sync-CZMRB3aU.js";
+import { t as addModules } from "./add-I8OW-qJH.js";
+import { n as listModules, t as printModule } from "./print-DosQIFSy.js";
 import { a as sourceFlags, i as sourceArgs, n as SOURCE_ARGS } from "./source-args-IpJRJO5t.js";
-import { a as runMetadataGen, n as checkMetadataFlags, t as EMITS } from "./metadata-DVx9Zgbj.js";
+import { a as runMetadataGen, n as checkMetadataFlags, t as EMITS } from "./metadata-BfgHMe4q.js";
 import { a as runEnv } from "./env-BBl5L8Bf.js";
-import { c as watchLoop, o as parseInterval, r as specOptionsFromConfig, s as stampFiles, t as runSpec } from "./spec-DGVNMSSB.js";
+import { c as watchLoop, o as parseInterval, r as specOptionsFromConfig, s as stampFiles, t as runSpec } from "./spec-Cm2einTO.js";
 import { t as runSeed } from "./seed-Cz8PcXeT.js";
-import { t as upgrade } from "./upgrade-B596d4t8.js";
+import { t as upgrade } from "./upgrade-BFEIMC7U.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/commands/sql.ts

package/dist/cli/index.d.ts

@@ -798,6 +798,6 @@ export declare function emitModule(model: Model, options: EmitOptions): string;
 export declare function loadConfig(cwd: string, explicit?: string, environment?: string, path?: string | undefined): Promise<ResolvedConfig>;
 //#endregion
 //#region src/cli/version.d.ts
-export declare const VERSION = "0.15.0";
+export declare const VERSION = "0.16.0";
 //#endregion
 export type { Catalog, CatalogCheck, CatalogColumn, CatalogColumnGrant, CatalogEnum, CatalogForeignKey, CatalogFunction, CatalogFunctionArg, CatalogGrant, CatalogIndex, CatalogPolicy, CatalogTable, CatalogTrigger, CatalogUnique, Choice, Cli, CliArgs, CliCommand, CliCommandDef, CliContext, CliEnv, CliErrorCode, CliErrorOptions, CliIo, CliLog, CliProblem, CliProblemExtensions, CommandResult, CreateCliOptions, ExitCode, ExtrasFunction, ExtrasHook, ExtrasHookFunction, ExtrasTable, ForeignKeyAction, Format, GeneratorMetadata, IntrospectionSource, ManagementSourceOptions, NextStep, Paint, Prompter, Queryable, RunOptions, RunResult, Snapshot, SnapshotBucket, SnapshotExtras };

package/dist/cli/index.js

@@ -1,12 +1,12 @@
 import { a as list, r as defineCliCommand } from "./command-CQ61x6gN.js";
-import { i as run, n as createCli, r as help, t as commandNames } from "./run-DYhLBcFW.js";
-import { t as VERSION } from "./version-Du4CgONY.js";
+import { i as run, n as createCli, r as help, t as commandNames } from "./run-MRET30vh.js";
+import { t as VERSION } from "./version-B2Dr6VmJ.js";
 import { n as CliError, t as CLI_ERRORS_URL } from "./errors-BTe6A15O.js";
-import { a as serializeSnapshot, i as parseSnapshot, l as introspect, t as loadSnapshot } from "./snapshot-C8MVPyO8.js";
-import { a as emitBlockConfig, l as buildModel, o as GENERATED_HEADER, r as renderFiles, s as emitModule } from "./render-ucJmUyuM.js";
-import { a as toCatalog, n as managementSource, r as pgSource } from "./source-DANaJJVc.js";
+import { a as serializeSnapshot, i as parseSnapshot, l as introspect, t as loadSnapshot } from "./snapshot-uTUlEzY2.js";
+import { a as emitBlockConfig, l as buildModel, o as GENERATED_HEADER, r as renderFiles, s as emitModule } from "./render-5y5a1QZr.js";
+import { a as toCatalog, n as managementSource, r as pgSource } from "./source-D2gJHKwC.js";
 import { s as loadConfig } from "./config-9t5ec_N7.js";
-import { n as runGen } from "./run-CvYVAztY.js";
+import { n as runGen } from "./run-Bs4OKdDI.js";
 //#region src/cli/introspect/from-catalog.ts
 /**
 * Builds a snapshot from catalog records: the inverse of `toCatalog`. Tests and

package/dist/cli/{init-D-aDv9r5.js → init-CHj9ad4S.js}

@@ -2,14 +2,14 @@ import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CQ
 import { i as plain } from "./style-Bm2X5JrN.js";
 import { n as CliError } from "./errors-BTe6A15O.js";
 import { r as readIfExists } from "./io-DH1kcmmP.js";
-import { l as TYPEGEN_VERSION } from "./cache-CXgR_Ahi.js";
+import { l as TYPEGEN_VERSION } from "./cache-AznIssjI.js";
 import { a as findConfig, s as loadConfig } from "./config-9t5ec_N7.js";
-import { r as contentMapperFiles } from "./content-mapper-DNs7lTu7.js";
+import { r as contentMapperFiles } from "./content-mapper-DCrz6OIv.js";
 import { i as changeLines, n as PLAN_ARGS, r as applyPlan, u as planResult } from "./files-CX71yBm8.js";
-import { C as promptConventions, S as hasConventionFlags, _ as templatePlan, b as conventionFlags, c as AUTHZ_NOTE, d as chooseIntegrations, f as integrationFiles, g as templateContextFor, h as parseIntegrations, i as blocksWiringPath, l as createUrlParam, m as packagesFor, o as writeDesign, p as overwrite, r as blockConfigImport, s as readPresetInput, u as CANCELLED, v as CONVENTION_ARGS, w as withConventions, x as defaultConventions, y as CONVENTION_COMPLETIONS } from "./add-BgsUjCan.js";
-import { a as wiringFiles, c as baseFiles, f as needsLib, i as wiringChecklist, m as suggestedIntegrations, n as latestMigrationVersion, o as wiringFor, p as resolveIntegrations, r as configInstances, s as TEMPLATES } from "./migration-safety-D7PhzFxm.js";
+import { C as promptConventions, S as hasConventionFlags, _ as templatePlan, b as conventionFlags, c as AUTHZ_NOTE, d as chooseIntegrations, f as integrationFiles, g as templateContextFor, h as parseIntegrations, i as blocksWiringPath, l as createUrlParam, m as packagesFor, o as writeDesign, p as overwrite, r as blockConfigImport, s as readPresetInput, u as CANCELLED, v as CONVENTION_ARGS, w as withConventions, x as defaultConventions, y as CONVENTION_COMPLETIONS } from "./add-D7TkPdco.js";
+import { a as wiringFiles, c as baseFiles, f as needsLib, i as wiringChecklist, m as suggestedIntegrations, n as latestMigrationVersion, o as wiringFor, p as resolveIntegrations, r as configInstances, s as TEMPLATES } from "./migration-safety-BnnXPAro.js";
 import { n as installCommand, t as detectProject } from "./detect-D9JaAX20.js";
-import { s as enablePgDelta, t as syncModules } from "./sync-btj01bcM.js";
+import { s as enablePgDelta, t as syncModules } from "./sync-CZMRB3aU.js";
 import { existsSync } from "node:fs";
 import { join, posix, resolve } from "node:path";
 import { glob, readFile } from "node:fs/promises";

package/dist/cli/legacy-prefix-DkTA3Rhx.js

@@ -0,0 +1,141 @@
+//#region src/cli/sql/legacy-prefix.ts
+/**
+* Prefixes of the names the library builds outside the module files (realtime
+* broadcast triggers, tenant checks, state transitions, JSON Schema checks).
+*/
+const LEGACY_PREFIXES = [
+	"bs_broadcast_",
+	"bs_same_tenant_",
+	"bs_transition_",
+	"bs_json_"
+];
+const LEGACY_NAME = /\bbs_[a-z0-9_]+/g;
+/**
+* JWT claims under their 0.14 name, which 0.15 module SQL still reads; they
+* name no database object.
+*/
+const LEGACY_CLAIMS = /* @__PURE__ */ new Set(["bs_permission_cap"]);
+/** The `bs_` object names in installed module SQL, before 0.15 renamed them. */
+function legacyPrefixNames(text) {
+	return [...new Set(text.match(LEGACY_NAME))].filter((name) => !LEGACY_CLAIMS.has(name)).toSorted();
+}
+const array = (values) => `array[${values.map((value) => `'${value.replaceAll("'", "''")}'`).join(", ")}]::text[]`;
+/**
+* Renames the installed `bs_` triggers, policies, constraints, indexes and
+* functions to `bsb_`, so the module files' `drop ... if exists bsb_x` replace
+* them instead of adding a second copy. Only the names in `names` and the
+* runtime prefixes are renamed, and only while the new name is free, so the
+* step can run again.
+*/
+function legacyPrefixSql(names) {
+	return `do $bsb_rename$
+declare
+  v_names constant text[] := ${array(names)};
+  v_prefixes constant text[] := ${array(LEGACY_PREFIXES)};
+  r record;
+begin
+  for r in
+    select t.tgname as name, t.tgrelid::regclass::text as rel
+    from pg_trigger t
+    where not t.tgisinternal
+      and (t.tgname = any (v_names) or exists (select 1 from unnest(v_prefixes) x where starts_with(t.tgname, x)))
+      and not exists (select 1 from pg_trigger u where u.tgrelid = t.tgrelid and u.tgname = 'bsb_' || substr(t.tgname, 4))
+  loop
+    begin
+      execute format('alter trigger %I on %s rename to %I', r.name, r.rel, 'bsb_' || substr(r.name, 4));
+    exception when insufficient_privilege then
+      raise warning 'better-supabase: rename % to bsb_% by hand; the migration role does not own it', r.name, substr(r.name, 4);
+    end;
+  end loop;
+
+  for r in
+    select p.polname as name, p.polrelid::regclass::text as rel
+    from pg_policy p
+    where (p.polname = any (v_names) or exists (select 1 from unnest(v_prefixes) x where starts_with(p.polname, x)))
+      and not exists (select 1 from pg_policy q where q.polrelid = p.polrelid and q.polname = 'bsb_' || substr(p.polname, 4))
+  loop
+    begin
+      execute format('alter policy %I on %s rename to %I', r.name, r.rel, 'bsb_' || substr(r.name, 4));
+    exception when insufficient_privilege then
+      raise warning 'better-supabase: rename % to bsb_% by hand; the migration role does not own it', r.name, substr(r.name, 4);
+    end;
+  end loop;
+
+  for r in
+    select c.conname as name, c.conrelid::regclass::text as rel
+    from pg_constraint c
+    where c.conrelid <> 0
+      and (c.conname = any (v_names) or exists (select 1 from unnest(v_prefixes) x where starts_with(c.conname, x)))
+      and not exists (select 1 from pg_constraint d where d.conrelid = c.conrelid and d.conname = 'bsb_' || substr(c.conname, 4))
+  loop
+    begin
+      execute format('alter table %s rename constraint %I to %I', r.rel, r.name, 'bsb_' || substr(r.name, 4));
+    exception when insufficient_privilege then
+      raise warning 'better-supabase: rename % to bsb_% by hand; the migration role does not own it', r.name, substr(r.name, 4);
+    end;
+  end loop;
+
+  for r in
+    select n.nspname as schema, i.relname as name
+    from pg_class i
+    join pg_namespace n on n.oid = i.relnamespace
+    where i.relkind in ('i', 'I')
+      and (i.relname = any (v_names) or exists (select 1 from unnest(v_prefixes) x where starts_with(i.relname, x)))
+      and not exists (select 1 from pg_constraint c where c.conindid = i.oid)
+      and to_regclass(format('%I.%I', n.nspname, 'bsb_' || substr(i.relname, 4))) is null
+  loop
+    begin
+      execute format('alter index %I.%I rename to %I', r.schema, r.name, 'bsb_' || substr(r.name, 4));
+    exception when insufficient_privilege then
+      raise warning 'better-supabase: rename % to bsb_% by hand; the migration role does not own it', r.name, substr(r.name, 4);
+    end;
+  end loop;
+
+  for r in
+    select f.oid::regprocedure::text as fn, f.proname as name
+    from pg_proc f
+    join pg_namespace n on n.oid = f.pronamespace
+    where n.nspname not in ('pg_catalog', 'information_schema')
+      and (f.proname = any (v_names) or exists (select 1 from unnest(v_prefixes) x where starts_with(f.proname, x)))
+      and not exists (
+        select 1 from pg_proc g
+        where g.pronamespace = f.pronamespace and g.proname = 'bsb_' || substr(f.proname, 4)
+          and g.proargtypes = f.proargtypes
+      )
+  loop
+    begin
+      execute format('alter function %s rename to %I', r.fn, 'bsb_' || substr(r.name, 4));
+    exception when insufficient_privilege then
+      raise warning 'better-supabase: rename % to bsb_% by hand; the migration role does not own it', r.name, substr(r.name, 4);
+    end;
+  end loop;
+end
+$bsb_rename$;`;
+}
+/**
+* Creates `better_supabase.blocks` and copies the rows of the 0.14
+* `better_supabase.modules` table into it, so the schema diff that drops the
+* old table loses no installed versions.
+*/
+const legacyBlocksTableSql = `create schema if not exists better_supabase;
+create table if not exists better_supabase.blocks (
+  name text primary key,
+  version integer not null,
+  mode text not null,
+  installed_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+alter table better_supabase.blocks enable row level security;
+revoke all on better_supabase.blocks from anon, authenticated;
+grant select on better_supabase.blocks to service_role;
+do $bsb_blocks$
+begin
+  if to_regclass('better_supabase.modules') is not null then
+    insert into better_supabase.blocks (name, version, mode, installed_at, updated_at)
+    select name, version, mode, installed_at, updated_at from better_supabase.modules
+    on conflict (name) do nothing;
+  end if;
+end
+$bsb_blocks$;`;
+//#endregion
+export { legacyPrefixSql as a, legacyPrefixNames as i, LEGACY_PREFIXES as n, legacyBlocksTableSql as r, LEGACY_CLAIMS as t };

package/dist/cli/{live-iEeH15ck.js → live-DGdLR41j.js}

@@ -1,6 +1,6 @@
 import { r as errorText } from "./errors-BTe6A15O.js";
-import "./source-DANaJJVc.js";
-import { l as tableObject, n as exposed, s as qualified, t as catalogOf } from "./shared-LZroULBe.js";
+import "./source-D2gJHKwC.js";
+import { l as tableObject, n as exposed, s as qualified, t as catalogOf } from "./shared-BLqbvY2x.js";
 //#region src/cli/doctor/reserved-roles.ts
 /**
 * Supautils' `reserved_roles` on Supabase. Nobody but a superuser may alter,

package/dist/cli/{mcp-BAPyaQ62.js → mcp-BZno503V.js}

@@ -1,6 +1,6 @@
 import { p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
-import { a as envelope, i as run } from "./run-DYhLBcFW.js";
-import { t as VERSION } from "./version-Du4CgONY.js";
+import { a as envelope, i as run } from "./run-MRET30vh.js";
+import { t as VERSION } from "./version-B2Dr6VmJ.js";
 import { n as CliError } from "./errors-BTe6A15O.js";
 import { n as consentToken } from "./agent-CbuPvI2x.js";
 import { C as optional, D as record, N as unknown, a as array, d as is, j as string$1, k as safeParse, o as boolean, t as PROCESS_ENV, x as object } from "./env-DMgjB_4y.js";

package/dist/cli/{metadata-DVx9Zgbj.js → metadata-BfgHMe4q.js}

@@ -1,8 +1,8 @@
 import { n as CliError, r as errorText } from "./errors-BTe6A15O.js";
 import { i as readStdin } from "./io-DH1kcmmP.js";
-import { m as parseMetadataDocument, u as MetadataRejectedError } from "./snapshot-C8MVPyO8.js";
-import { c as metaPaths, n as render } from "./render-ucJmUyuM.js";
-import { i as generationNotices, n as runGen, o as fromMetadata, r as UNFORMATTED, t as refuseRowConditionedBuckets } from "./run-CvYVAztY.js";
+import { m as parseMetadataDocument, u as MetadataRejectedError } from "./snapshot-uTUlEzY2.js";
+import { c as metaPaths, n as render } from "./render-5y5a1QZr.js";
+import { i as generationNotices, n as runGen, o as fromMetadata, r as UNFORMATTED, t as refuseRowConditionedBuckets } from "./run-Bs4OKdDI.js";
 import { basename, join, relative, resolve, sep } from "node:path";
 import { readFile } from "node:fs/promises";
 import { jsonSchema, standardSchema, valibot, zod } from "better-supabase/config";

package/dist/cli/{migration-safety-D7PhzFxm.js → migration-safety-BnnXPAro.js}

@@ -1,5 +1,5 @@
 import { f as INTEGRATIONS } from "./config-9t5ec_N7.js";
-import { c as splitStatements } from "./shared-LZroULBe.js";
+import { c as splitStatements } from "./shared-BLqbvY2x.js";
 import { dirname, join, posix } from "node:path";
 import { readdir } from "node:fs/promises";
 import { INTEGRATION_INFO, groupEntries } from "better-supabase/config";

package/dist/cli/{module-migration-aPCckev6.js → module-migration-O_IxewFs.js}

@@ -1,13 +1,11 @@
 import { n as CliError } from "./errors-BTe6A15O.js";
-import { d as TypegenMissingError, i as parseSnapshot } from "./snapshot-C8MVPyO8.js";
-import { a as toCatalog } from "./source-DANaJJVc.js";
-import { d as readSupabaseToml, f as schemaPaths, n as declarativeSchemasDir, p as sqlWorkflow } from "./supabase-toml-CncmQbO0.js";
+import { d as readSupabaseToml, p as sqlWorkflow } from "./supabase-toml-CncmQbO0.js";
 import { t as importFresh } from "./fresh-import-DzgsGHkX.js";
 import { i as changeLines, r as applyPlan } from "./files-CX71yBm8.js";
-import { existsSync } from "node:fs";
-import { dirname, join, relative, resolve, sep } from "node:path";
+import { a as sqlPlan, i as schemasDirOf, n as migrationsDir, r as moduleLayoutFor } from "./sql-layout-lUWenjJw.js";
+import { resolve } from "node:path";
 import { readFile, readdir } from "node:fs/promises";
-import { MODULE_ID_TYPES, adoptedColumnProblems, auditRegistrations, compileReadSets, declaredPolicies, declaredTableColumns, declaredTables, declaredUpdatedAtTriggers, extensionSchema, moduleIdType, moduleLayout, modulePermissionKeys, moduleSchemaExtensions, policyGrants, renderBlocks, resolveBlocks, resolveExposeColumns, rlsTables, sameTenantLayout, scopeProblems, templateFunctions } from "better-supabase/sql";
+import { MODULE_ID_TYPES, compileReadSets, moduleIdType, moduleLayout, modulePermissionKeys, moduleSchemaExtensions, renderBlocks, resolveBlocks, scopeProblems, templateFunctions } from "better-supabase/sql";
 import { isReadSet } from "better-supabase";
 //#region src/cli/authorization.ts
 /** How findings name the provider. */
@@ -210,215 +208,6 @@ const entitlementRequirements = (provider) => [...templateFunctions(provider.mem
 	role: "supabase_auth_admin"
 }))];
 //#endregion
-//#region src/cli/sql-layout.ts
-/** The folder the module data files sit next to, for the project's workflow. */
-async function schemasDirOf(config) {
-	const toml = await readSupabaseToml(config.root);
-	return declarativeSchemasDir(toml, sqlWorkflow(config, toml));
-}
-/** The declarative schema files, then the migrations oldest first. */
-async function schemaTexts(config) {
-	const toml = await readSupabaseToml(config.root);
-	const migrations = resolve(config.root, migrationsDir(config));
-	const paths = [...(await schemaPaths(config.root, toml, sqlWorkflow(config, toml))).files, ...existsSync(migrations) ? (await readdir(migrations)).filter((name) => name.endsWith(".sql")).toSorted().map((name) => join(migrations, name)) : []];
-	return Promise.all(paths.map(async (path) => ({
-		path,
-		text: await readFile(resolve(config.root, path), "utf-8")
-	})));
-}
-async function declarativeTexts(config) {
-	const toml = await readSupabaseToml(config.root);
-	const { files } = await schemaPaths(config.root, toml, sqlWorkflow(config, toml));
-	if (files.length === 0) return schemaTexts(config);
-	return Promise.all(files.map(async (path) => ({
-		path,
-		text: await readFile(resolve(config.root, path), "utf-8")
-	})));
-}
-/**
-* The `better_supabase.audit(...)` calls in the declarative schemas, then the
-* migrations oldest first, so a later call or `unaudit` wins.
-*/
-async function auditedTables(config) {
-	return auditRegistrations(await schemaTexts(config));
-}
-/**
-* The layout `upgrade` and doctor render the module files with, so both see the
-* same grants, session policies, audit triggers and vector schema.
-*/
-async function moduleLayoutFor(config, input) {
-	const resolved = new Set(resolveBlocks(input.names, input.entitlementsProvider ? { entitlementsProvider: input.entitlementsProvider } : {}).map((module) => module.name));
-	const own = await ownLayout(config);
-	const adopted = adoptedColumnProblems(config.blocks, await declarativeTexts(config), config.schemas, own.ownTables);
-	if (adopted.length > 0) throw new TypeError(adopted.join("\n"));
-	const fromPolicies = resolved.has("grants") && config.blocks["grants"]?.options?.["fromPolicies"] === true;
-	const sessionPolicies = resolved.has("sessions") && config.blocks["sessions"]?.options?.["policies"] === true;
-	const sameTenant = config.blocks["memberships"]?.options?.["sameTenant"];
-	const autoSameTenant = resolved.has("memberships") && typeof sameTenant === "object" && sameTenant !== null && "auto" in sameTenant && sameTenant.auto === true;
-	const base = moduleLayout(config, input.testsDir, input.readSets ?? [], input.entitlementsProvider, input.accessProvider, input.permissionCatalog);
-	const grants = base.grants === void 0 ? void 0 : resolveExposeColumns(base.grants, await declarativeTexts(config), config.schemas);
-	return {
-		...base,
-		...grants === void 0 ? {} : { grants },
-		schemasDir: await schemasDirOf(config),
-		...resolved.has("audit") ? { auditedTables: await auditedTables(config) } : {},
-		...resolved.has("vector-search") ? vectorSchemaOf(await schemaTexts(config)) : {},
-		...fromPolicies ? { policyGrants: policyGrants(await declarativeTexts(config), config.schemas) } : {},
-		...fromPolicies ? { rlsTables: rlsTables(await declarativeTexts(config), config.schemas) } : {},
-		...autoSameTenant ? sameTenantLayout(await declarativeTexts(config), config.schemas) : {},
-		...fromPolicies || sessionPolicies ? { declaredTables: declaredTables(await declarativeTexts(config), config.schemas) } : {},
-		...own
-	};
-}
-/**
-* `ownTables`, `ownColumns`, `ownUpdatedAtTriggers` and `ownPolicies`: the
-* database's tables, then the app's files.
-*/
-async function ownLayout(config) {
-	const database = await databaseTables(config);
-	const own = (await declarativeTexts(config)).filter((source) => !writtenByBlocks(source));
-	const columns = Object.fromEntries([...declaredTableColumns(own, config.schemas)].map(([table, names]) => [table, [...names]]));
-	return {
-		ownTables: {
-			...database.tables,
-			...ownDeclaredTables(own, config.schemas)
-		},
-		ownColumns: {
-			...database.columns,
-			...columns
-		},
-		ownUpdatedAtTriggers: {
-			...database.updatedAtTriggers,
-			...declaredUpdatedAtTriggers(own, config.schemas)
-		},
-		ownPolicies: {
-			...database.policies,
-			...declaredPolicies(own, config.schemas)
-		}
-	};
-}
-/** A trigger function named like one that keeps `updated_at` current. */
-const UPDATED_AT_FUNCTION = /updated_at|moddatetime|touch/i;
-const BLOCK_MARKER = /^-- @(?:bsb-block|bsb-tables|bs-module|bs-app-tables)\b/m;
-const BLOCK_MIGRATION = /_better_supabase_[a-z_]+\.sql$/;
-/**
-* The `schema.table`s that the files better-supabase wrote create, among
-* `sources`; a table an app table entry enriches is not one of them.
-*/
-function blockDeclaredTables(sources, schemas) {
-	return new Set(declaredTables(sources.filter(writtenByBlocks), schemas));
-}
-/** A file better-supabase wrote: a block file or a module migration. */
-function writtenByBlocks(source) {
-	return BLOCK_MARKER.test(source.text) || BLOCK_MIGRATION.test(source.path);
-}
-/**
-* The tables in the saved snapshot (`source.snapshot`) that no block file or
-* module migration created, mapped to `database`. Without a snapshot, the app's
-* schema files and migrations stand in for it.
-*/
-async function databaseTables(config) {
-	const none = {
-		tables: {},
-		columns: {},
-		updatedAtTriggers: {},
-		policies: {}
-	};
-	const path = config.source.snapshot;
-	if (path === void 0 || !existsSync(resolve(config.root, path))) return none;
-	let snapshot;
-	try {
-		snapshot = await parseSnapshot(JSON.parse(await readFile(resolve(config.root, path), "utf-8")), path);
-	} catch (cause) {
-		if (cause instanceof TypegenMissingError) return none;
-		throw cause;
-	}
-	const created = blockDeclaredTables(await schemaTexts(config), config.schemas);
-	const tables = {};
-	const columns = {};
-	const updatedAtTriggers = {};
-	const policies = {};
-	for (const table of toCatalog(snapshot).tables) {
-		const name = `${table.schema}.${table.name}`;
-		if (config.schemas.includes(table.schema) && !created.has(name)) {
-			tables[name] = "database";
-			columns[name] = table.columns.map((column) => column.name);
-			const kept = table.triggers.find((trigger) => !trigger.name.startsWith("bsb_") && trigger.events.includes("update") && UPDATED_AT_FUNCTION.test(trigger.function));
-			if (kept !== void 0) updatedAtTriggers[name] = kept.name;
-			policies[name] = table.policies.filter((policy) => !policy.name.startsWith("bsb_"));
-		}
-	}
-	return {
-		tables,
-		columns,
-		updatedAtTriggers,
-		policies
-	};
-}
-/**
-* `schema.table` to the app's own schema file that creates it: every
-* declarative file, or migration, that better-supabase didn't write.
-*/
-function ownDeclaredTables(sources, schemas) {
-	const ownTables = {};
-	for (const source of sources) for (const table of declaredTables([source], schemas)) ownTables[table] ??= source.path;
-	return ownTables;
-}
-function vectorSchemaOf(sources) {
-	const schema = extensionSchema(sources, "vector");
-	return schema === void 0 ? {} : { vectorSchema: schema };
-}
-/**
-* The folder that holds both the project root and `sql.dir`: the root, or an
-* ancestor when `sql.dir` points at a shared stack. The `sql` commands write
-* SQL files only inside it.
-*/
-function sqlRoot(config) {
-	const dir = resolve(config.root, config.sql.dir);
-	let stop = resolve(config.root);
-	while (dir !== stop && !dir.startsWith(stop + sep) && dirname(stop) !== stop) stop = dirname(stop);
-	return stop;
-}
-/**
-* A plan for files under the project root or `sql.dir`, with paths relative to
-* the project root.
-*/
-function sqlPlan(config, plan) {
-	return {
-		...plan,
-		root: sqlRoot(config),
-		base: config.root,
-		files: plan.files.map((file) => ({
-			...file,
-			path: resolve(config.root, file.path)
-		})),
-		...plan.remove ? { remove: plan.remove.map((entry) => {
-			const path = resolve(config.root, typeof entry === "string" ? entry : entry.path);
-			return typeof entry === "string" ? path : {
-				...entry,
-				path
-			};
-		}) } : {}
-	};
-}
-/**
-* The migrations folder next to the `config.toml` found walking up from
-* `sql.dir`, relative to the root; `supabase/migrations` without one. The walk
-* stops where `sql.dir` and the root meet, so a `sql.dir` outside the project
-* (a shared stack in a monorepo) finds that stack's folder.
-*/
-function migrationsDir(config) {
-	const root = resolve(config.root);
-	let dir = resolve(root, config.sql.dir);
-	const stop = sqlRoot(config);
-	for (;;) {
-		if (existsSync(join(dir, "config.toml"))) return relative(root, join(dir, "migrations")).replaceAll("\\", "/");
-		if (dir === stop || dirname(dir) === dir) break;
-		dir = dirname(dir);
-	}
-	return "supabase/migrations";
-}
-//#endregion
 //#region src/cli/read-sets.ts
 /** Every read set exported by the modules in `config.readSets`. */
 async function loadReadSets(config) {
@@ -731,4 +520,4 @@ async function writeLatestMigration(config, suffix, contents, options) {
 	};
 }
 //#endregion
-export { providerLabel as A, sqlPlan as C, entitlementRequirements as D, accessRequirements as E, entitlementsMode as O, moduleLayoutFor as S, accessProviderMode as T, layoutFor as _, migrationInstances as a, blockDeclaredTables as b, sameModuleMigration as c, DATA_NEXT as d, dataMigration as f, layout as g, MEMBERSHIP_CLAIM_MODULES as h, migrationHolds as i, unsafeKey as j, moduleKeyProblems as k, writeLatestMigration as l, writeExtensionsMigration as m, READ_SETS_SUFFIX as n, migrationModules as o, migrationStamp as p, latestMigration as r, renderModuleMigration as s, MODULES_SUFFIX as t, writesMigrations as u, providerOwnsMemberships as v, writtenByBlocks as w, migrationsDir as x, compiledReadSets as y };
+export { entitlementsMode as C, unsafeKey as E, entitlementRequirements as S, providerLabel as T, layoutFor as _, migrationInstances as a, accessProviderMode as b, sameModuleMigration as c, DATA_NEXT as d, dataMigration as f, layout as g, MEMBERSHIP_CLAIM_MODULES as h, migrationHolds as i, writeLatestMigration as l, writeExtensionsMigration as m, READ_SETS_SUFFIX as n, migrationModules as o, migrationStamp as p, latestMigration as r, renderModuleMigration as s, MODULES_SUFFIX as t, writesMigrations as u, providerOwnsMemberships as v, moduleKeyProblems as w, accessRequirements as x, compiledReadSets as y };

package/dist/cli/{print-BeWO7OJY.js → print-DosQIFSy.js}

@@ -1,5 +1,5 @@
 import { n as CliError } from "./errors-BTe6A15O.js";
-import { g as layout, o as migrationModules, r as latestMigration, u as writesMigrations } from "./module-migration-aPCckev6.js";
+import { g as layout, o as migrationModules, r as latestMigration, u as writesMigrations } from "./module-migration-O_IxewFs.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { SQL_MODULES, contractSignature, customContracts, moduleBody, moduleFilePaths } from "better-supabase/sql";

package/dist/cli/{remove-B46Dmd2M.js → remove-DK2G_KHm.js}

@@ -2,14 +2,15 @@ import { p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
 import { i as plain } from "./style-Bm2X5JrN.js";
 import { n as CliError } from "./errors-BTe6A15O.js";
 import { r as readIfExists, t as display } from "./io-DH1kcmmP.js";
-import { C as sqlPlan, _ as layoutFor } from "./module-migration-aPCckev6.js";
+import { _ as layoutFor } from "./module-migration-O_IxewFs.js";
 import { i as changeLines, n as PLAN_ARGS, r as applyPlan, t as HAND_EDITED, u as planResult } from "./files-CX71yBm8.js";
-import { g as templateContextFor, i as blocksWiringPath, n as blockClients } from "./add-BgsUjCan.js";
+import { a as sqlPlan } from "./sql-layout-lUWenjJw.js";
+import { g as templateContextFor, i as blocksWiringPath, n as blockClients } from "./add-D7TkPdco.js";
 import { t as detectProject } from "./detect-D9JaAX20.js";
 import { _ as wiringBlocks, a as configObject, c as mask, i as closingIndex, l as properties } from "./config-edit-CrWfk8s3.js";
-import { n as guardedRemoval } from "./sync-btj01bcM.js";
+import { n as guardedRemoval } from "./sync-CZMRB3aU.js";
 import { t as SQL_ARGS } from "./args-UEwg0l-N.js";
-import { t as blockNames } from "./blocks-BZHI8mRC.js";
+import { t as blockNames } from "./blocks-xk-SE8gS.js";
 import { i as tidyInline, t as cutRange } from "./config-group-C8tjut39.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";